[chaliy]

Requested by Михайло · project thread

What changed

Addresses the three review findings on #2831 (merged before they were handled):

• Budget before parse: Python source is charged to the execution budget (input bytes + work) before the re gate parses it, so a multi-MB script is accounted for before any work is done on it.
• Parser pinned with Monty: ruff_python_parser/ruff_python_ast are Dependabot-ignored, like monty, so the gate can't drift to a grammar the executor doesn't share (code the gate fails to parse is passed through).
• exec/eval/compile pinned absent: a test asserts exec('import re'), eval(...) and compile(...) fail with no output. Monty 0.0.19 has none of them; if an upgrade adds one, the test fails instead of silently reopening the gate.

Why

Review of #2831 by bashkit-pr-reviewer (P1 exec path unpinned, P2 parse-before-budget, P2 Dependabot skew).

Before / After

No behavior change for valid programs. Verified on main: exec("import re") → RuntimeError: no external function handler configured (name not defined), exit 1; now pinned by test_re_module_dynamic_import_is_unavailable.

Risk

• Low
• Over-budget scripts now fail on the budget check rather than the gate; same exit path as before for scripts that pass the gate.

Checklist

• Tests added or updated
• Backward compatibility considered

---

Generated by Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	1e01fcd	Commit Preview URL Branch Preview URL	Nov 05 2026, 05:03 AM

[bashkit-pr-reviewer]

Follow-up fixes verified in part, but the exec/eval pin does not actually pin (P1), and the gate's completeness comment is now stale (P2). Budget-before-parse and Dependabot pinning check out. Details inline.

Comments outside the diff

crates/bashkit/src/builtins/python.rs line 355: [P2] This completeness claim is now stale: the new test (lines 1919–1920) acknowledges that exec/eval/compile would run imports the outer AST never shows, but the gate's own comment still lists only __import__/importlib as the reason import/from statements are the only loaders. If someone reads this comment to audit the gate, they will miss the exact bypass class the test pins. Fix: extend the comment to name exec/eval/compile as also-absent (with a pointer to test_re_module_dynamic_import_is_unavailable as the tripwire), so the design record stays next to the code it justifies.

[bashkit-pr-reviewer]

Review verdict (head 1e01fcd): rebase only — no new findings, no review submitted

What changed since last review (68a7582 → 1e01fcd): PR content is byte-identical (same four hunks, same true-pin payloads using json/x = 41/6 * 7, same expanded gate comment); the push is a rebase onto newer main (base 876421f → fe82ced, test block shifted 1960s→2020s, gate comment 384→392). Full diff reviewed, not truncated; re-verified the pin payloads and gate comment in the refreshed checkout.

Earlier findings — both remain resolved: P1 tautological pin (fixed by supported-feature payloads) and P2 stale gate comment (fixed by naming all five absent loaders with the tripwire pointer). Budget-before-parse ordering, Dependabot placement, and same-change knowledge updates still check out. No build/test run (out of scope for this shell).